amadan
Design: an address sender's address is fixed once claimed
Found by the review of plan 3. Without the two refusals, enable --from with a different address renders a policy for the new one, strands the old claim where it blocks every sibling app in the account, and leaves the delivered _FROM and the policy naming different addresses while status still reads healthy.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 file changed,
+10
−0
docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md+10 −0
diff --git a/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md b/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md| index 58fa133a3..0c2403b01 100644 |
| --- a/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md |
| +++ b/docs/superpowers/specs/2026-09-15-tenant-email-senders-design.md |
| @@ -505,6 +505,16 @@ record as a grant. The policy condition is |
| `StringEqualsIgnoreCase ses:FromAddress`, since SES's `StringEquals` is |
| case-sensitive and a From address is not. |
| +**An address sender's address is fixed once claimed.** Changing it means |
| +tearing the sender down and claiming again, and two doors refuse the |
| +shortcut: the claim door when the sender already holds a different |
| +address, and `Declare` when a From address would disagree with the |
| +claimed one. Without both, `carlos email enable --from other@tito.io` on |
| +a live sender renders a policy for the new address, strands the old |
| +claim — which blocks every sibling app in the account and holds the |
| +identity association open — and leaves `_FROM` and the policy naming |
| +different addresses while status still reads healthy. |
| + |
| **Counting an address sender depends on the app.** Because there is no |
| tenant-level default set (§3) and CARLOS may not touch `tito.io`'s |
| default, events only reach CARLOS when the message names CARLOS's |